INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ClearFake Deploys Crypto Stealer via Vulnerable Driver to Kill EDR

| 2026-09-11 02:01 CRITICAL MEDIUM RANSOMWARE & EXTORTION VULNERABILITY DISCLOSURE MALWARE & BOTNETS FRAUD & CRYPTO THEFT
JSON
Executive Summary
AI-generated
In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. The attack works by delivering the malware through a multi-stage ClickFix infection chain, which supports various features including encrypted code blocks and anti-analysis techniques. As of September 11, 2026, no specific number of affected entities or individuals has been reported; however, ThreatLabz observed SloppyRAT being used in conjunction with other malicious tools such as Amatera and ZigCryptoStealer. The current status is that the malware remains a threat to organizations using vulnerable systems, while Cisco Talos continues to monitor endpoint telemetry for signs of infection by ClearFake WebDAV, which also employs these malicious tools.
Technical Mitigations AI-generated
• Block the following hashes: <a href="/auth/login?next=/detail/wfezhKABGvYhsJJTTyhk" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>, • Use the technique "Yamux Reverse" to detect ClearFake WebDAV infection chains.
Technical Observables 75 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 75 IoCs Create Free Account
urls 3 sha256 22 domains 24 files 14 sha1 4 ips 3 md5 5
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA cryptocurrencycryptocurrency governmentgovernment technologytechnology
Incident Timeline
‎2026/09/11
Threat actors used a Cloudflare Worker to inject JavaScript code stored on BNB Smart Chain, leading to the download and execution of Amatera stealer payload.
infrastructure Windows
Since the subject of our initial research was a customer running Windows, we have not further pursued the macOS side of the "pf.ch" branch.
Initial finding in endpoint telemetry  The initial event that started the investigation was recorded in April 2026 and it showed an execution of a DLL file through a WebDAV UNC path together with startup of the Windows WebClient service.
If the victim is running Windows, it retrieves code from 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff and if the victim is running macOS, it uses 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5.
infrastructure Macos
Since the subject of our initial research was a customer running Windows, we have not further pursued the macOS side of the "pf.ch" branch.
If the victim is running Windows, it retrieves code from 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff and if the victim is running macOS, it uses 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5.
Censys documented the same Windows and macOS contracts in a blockchain-backed ClickFix chain, although the downstream payloads in that reporting differ from those analyzed here.
financial 1 function
Both use the 32-bit "rundll32.exe" process and invoke a function by calling the function ordinal #1.
Its tf: 1 and tr: 1 values select the file-based executable handler.
data_breach 73 byte
In the "pf.ch" build, a TLS-decoded HTTP buffer we were able to analyse contained a nonzero session identifier and an opaque 73-byte body whose framing is consistent with the ECDH and ChaCha20-Poly1305 protocol documented for recent Amatera versions.
data_breach 2 PE files
The side-loaded "Secur32.dll" is a NET NativeAOT loader which decrypts and loads 2 PE files.
infrastructure 4.1.5-alpha
The sample contains the build label 4.1.5-alpha and string GETWELLV2.
infrastructure 45.150.34
At runtime, it decrypts the fixed address "45.150.34[.]2" and connects to it directly on TCP port 443, while presenting "github[.]com" as the TLS server name and HTTP Host value.
infrastructure 12.44
The ZIP contains legitimate NetSupport Manager software  The launched "hypersnap.exe" is a renamed, signed NetSupport Manager 12.44 "client32.exe".
victims 12.44 client32.exe
The ZIP contains legitimate NetSupport Manager software  The launched "hypersnap.exe" is a renamed, signed NetSupport Manager 12.44 "client32.exe".
data_breach 39 successful setData calls
The same wallet that deployed it made 39 successful setData calls through July 26.
data_breach 100 unique filename
Across those rules, more than 100 unique filename and extension patterns look for private keys, wallet backups, API and OAuth material, two-factor authentication data, password databases and certificate files such as .kdbx, .p12, .pfx and .pem.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Initial finding in endpoint telemetry  The initial event that started the investigation was recorded in April 2026 and it showed an execution of a DLL file through a WebDAV UNC path together with startup of the Windows WebClient service.
If the victim is running Windows, it retrieves code from 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff and if the victim is running macOS, it uses 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5.
The Windows browser stage creates a victim identifier, stores it in the cjs_id cookie and asks a tracking contract whether the goal for that identifier has already been reached.
If the browser is not headless and the target is Windows, the script overlays a fake Google CAPTCHA-style checkbox onto the compromised page, instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter.
Windows ClickFix verification prompt.
Decoded Windows ClickFix command.
Censys documented the same Windows and macOS contracts in a blockchain-backed ClickFix chain, although the downstream payloads in that reporting differ from those analyzed here.
Since the subject of our initial research was a customer running Windows, we have not further pursued the macOS side of the "pf.ch" branch.
Once the event is triggered, it copies an embedded blob into memory and transfers control to it using Windows fibers.
The callback is later executed asynchronously by Windows.
Four file grabber rules cover the Desktop, Downloads, Documents and Windows Recent-items directory.
The NativeAOT DLL starts “C:\Windows\"explorer.exe" in a suspended state, manually maps the PE’s headers and sections into the child, changes its initial thread context to the new entry point, and resumes it.
The second decrypted PE is a signed Windows driver whose version information contains the names MOCOMSYS & DCRC and DCRCV_U Driver (for SCM).
The payload is a Golang 32-bit Windows executable with main package “github.com/acr/proxy-panel/cmd/bot”.
The proxy reads the Windows MachineGuid and hostname, then sends them over WebSocket Secure (wss) protocol.
Metrics
infrastructure
‎Macos
Affected Product
If the victim is running Windows, it retrieves code from 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff and if the victim is running macOS, it uses 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5.
Censys documented the same Windows and macOS contracts in a blockchain-backed ClickFix chain, although the downstream payloads in that reporting differ from those analyzed here.
The macOS browser stage uses the same headless-browser checks, victim tracking, and fake verification design, but its execution chain is different.
It instructs the victim to open Terminal and paste a command that uses curl with a macOS user-agent string.
Since the subject of our initial research was a customer running Windows, we have not further pursued the macOS side of the "pf.ch" branch.
Metrics
financial
1
Function
Both use the 32-bit "rundll32.exe" process and invoke a function by calling the function ordinal #1.
Its tf: 1 and tr: 1 values select the file-based executable handler.
Metrics
infrastructure
‎4.1.5-alpha
Software Version
The sample contains the build label 4.1.5-alpha and string GETWELLV2.
Metrics
data_breach
73
Byte
In the "pf.ch" build, a TLS-decoded HTTP buffer we were able to analyse contained a nonzero session identifier and an opaque 73-byte body whose framing is consistent with the ECDH and ChaCha20-Poly1305 protocol documented for recent Amatera versions.
Metrics
infrastructure
‎45.150.34
Software Version
At runtime, it decrypts the fixed address "45.150.34[.]2" and connects to it directly on TCP port 443, while presenting "github[.]com" as the TLS server name and HTTP Host value.
Metrics
data_breach
2
Pe Files
The side-loaded "Secur32.dll" is a NET NativeAOT loader which decrypts and loads 2 PE files.
Metrics
infrastructure
‎12.44
Software Version
The ZIP contains legitimate NetSupport Manager software  The launched "hypersnap.exe" is a renamed, signed NetSupport Manager 12.44 "client32.exe".
Metrics
victims
12
Client32.Exe
The ZIP contains legitimate NetSupport Manager software  The launched "hypersnap.exe" is a renamed, signed NetSupport Manager 12.44 "client32.exe".
Metrics
data_breach
39
Successful Setdata Calls
The same wallet that deployed it made 39 successful setData calls through July 26.
Metrics
data_breach
100
Unique Filename
Across those rules, more than 100 unique filename and extension patterns look for private keys, wallet backups, API and OAuth material, two-factor authentication data, password databases and certificate files such as .kdbx, .p12, .pfx and .pem.
Intelligence Sources
Talos Intelligence 2026-09-08
AlienVault OTX 2026-09-09
AlienVault OTX 2026-09-08
AlienVault OTX 2026-09-09
AlienVault OTX 2026-09-11